To implement the above rationale, we need to estimate the distribution
\(p(\cdot ) = \phi (q^{t}(\cdot ))\)  before moving forward to start learning at \(t+1\) .
The empirical version of the learned training distribution at time-step \(t\)  \(\hat{p}^{t}(\cdot )\) 
is encoded by the training data representations in the embedding space, \(\lbrace (\phi ^t_{\mathbf {v}}(\mathbf {x}_i^{t}),\mathbf {y}_i^{t})\rbrace _{i=1}^{N}\)  We have used a slight abuse of notation. We have assumed that \((\mathbf {x}_i^{t},\mathbf {y}_i^{t})\)  denotes all the samples that are accessible for training at time \(t\) . As we will see, these labeled samples consist of novel attack types that have been detected at time \(t\) , combined with the samples that are selected and stored in the replay buffer from the previous model update at time \(t-1\) .
Inspired by prototypical networks [1]},
we model \(\hat{p}^{t}(\mathbf {z})\)  as a Gaussian mixture model (GMM):
\(\small \hat{p}^{t}(\mathbf {z})=\sum _{j=1}^2 \alpha _j^{t} \hat{p}_i^{t}(\mathbf {z}|j)=\sum _{j=1}^2 \alpha ^t_j\mathcal {N}_j^{t}(\mathbf {z}|\mathbf {\mu }_j^{t},\mathbf {\Sigma }_j^{t}),\) 
